- Merge fixes from upstream for CVE-2011-2200

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

local users could disconnect system daemons from the bus by sending specially crafted messages (CVE-2011-2200).

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2011-676:02 advisory.

    D-BUS is a system for sending messages between applications. It is used both for the system-wide message     bus service, and as a per-user-login-session messaging facility.
    Security issues fixed with this release:
    CVE-2011-2200     The _dbus_header_byteswap function in dbus-marshal-header.c in D-Bus (aka DBus) 1.2.x before 1.2.28, 1.4.x     before 1.4.12, and 1.5.x before 1.5.4 does not properly handle a non-native byte order, which allows local     users to cause a denial of service (connection loss), obtain potentially sensitive information, or conduct     unspecified state-modification attacks via crafted messages.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201110-14 (D-Bus: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in D-Bus. Please review       the CVE identifiers referenced below for details.
  Impact :

    The vulnerabilities allow for local Denial of Service (daemon crash), or       arbitrary file overwriting.
  Workaround :

    There is no known workaround at this time.

The remote MiracleLinux 3 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2011-305:02 advisory.

    D-BUS is a system for sending messages between applications. It is used both for the system-wide message     bus service, and as a per-user-login-session messaging facility.
    Security issues fixed with this release:
    CVE-2011-2200     The _dbus_header_byteswap function in dbus-marshal-header.c in D-Bus (aka DBus) 1.2.x before 1.2.28, 1.4.x     before 1.4.12, and 1.5.x before 1.5.4 does not properly handle a non-native byte order, which allows local     users to cause a denial of service (connection loss), obtain potentially sensitive information, or conduct     unspecified state-modification attacks via crafted messages.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that DBus did not properly validate the byte order of messages under certain circumstances. An attacker could exploit this to cause a denial of service via application crash or potentially obtain access to sensitive information.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:1132 advisory.

  - dbus: Local DoS via messages with non-native byte order (CVE-2011-2200)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated dbus packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

D-Bus is a system for sending messages between applications. It is used for the system-wide message bus service and as a per-user-login-session messaging facility.

A denial of service flaw was found in the way the D-Bus library handled endianness conversion when receiving messages. A local user could use this flaw to send a specially crafted message to dbus-daemon or to a service using the bus, such as Avahi or NetworkManager, possibly causing the daemon to exit or the service to disconnect from the bus. (CVE-2011-2200)

All users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. For the update to take effect, all running instances of dbus-daemon and all running applications using the libdbus library must be restarted, or the system rebooted.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
55754	Fedora 15 : dbus-1.4.6-5.fc15 (2011-9891)	Nessus	Fedora Local Security Checks	2011/8/2	2021/1/11	medium
75461	openSUSE Security Update : dbus-1 (openSUSE-SU-2011:0880-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	medium
75812	openSUSE Security Update : dbus-1 (openSUSE-SU-2011:0880-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	medium
284045	MiracleLinux 4 : dbus-1.2.24-5.0.1.AXS4 (AXSA:2011-676:02)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	critical
55844	Fedora 14 : dbus-1.4.0-3.fc14 (2011-9817)	Nessus	Fedora Local Security Checks	2011/8/15	2021/1/11	medium
56589	GLSA-201110-14 : D-Bus: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2011/10/24	2021/1/6	medium
284454	MiracleLinux 3 : dbus-1.1.2-16.AXS3 (AXSA:2011-305:02)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	critical
55700	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 : dbus vulnerability (USN-1176-1)	Nessus	Ubuntu Local Security Checks	2011/7/27	2019/9/19	medium
55809	RHEL 5 / 6 : dbus (RHSA-2011:1132)	Nessus	Red Hat Local Security Checks	2011/8/10	2024/4/24	critical
56269	CentOS 5 : dbus (CESA-2011:1132)	Nessus	CentOS Local Security Checks	2011/9/23	2021/1/4	medium

检测

插件搜索

medium

medium

medium

critical

medium

medium

critical

medium

critical

medium